コード例 #1
0
    def run(self):
        seconds = 0
        nohuman = self.options.get("nohuman")
        if nohuman:
            return True
        file_type = self.config.file_type
        file_name = self.config.file_name
        officedoc = False
        if "Rich Text Format" in file_type or "Microsoft Word" in file_type or \
            "Microsoft Office Word" in file_type or file_name.endswith((".doc", ".docx", ".rtf")):
            officedoc = True
        elif "Microsoft Office Excel" in file_type or "Microsoft Excel" in file_type or \
            file_name.endswith((".xls", ".xlsx")):
            officedoc = True
        elif "Microsoft PowerPoint" in file_type or \
            file_name.endswith((".ppt", ".pptx", ".pps", ".ppsx", ".pptm", ".potm", ".potx", ".ppsm")):
            officedoc = True

        while self.do_run:
            if officedoc and seconds == 30:
                USER32.EnumWindows(EnumWindowsProc(get_office_window), 0)

            click_mouse()
            move_mouse()
            USER32.EnumWindows(EnumWindowsProc(foreach_window), 0)
            KERNEL32.Sleep(1000)
            seconds += 1
コード例 #2
0
    def run(self):
        # Global disable flag.
        if "human" in self.options:
            self.do_move_mouse = int(self.options["human"])
            self.do_click_mouse = int(self.options["human"])
            self.do_click_buttons = int(self.options["human"])
        else:
            self.do_move_mouse = True
            self.do_click_mouse = True
            self.do_click_buttons = True

        # Per-feature enable or disable flag.
        if "human.move_mouse" in self.options:
            self.do_move_mouse = int(self.options["human.move_mouse"])

        if "human.click_mouse" in self.options:
            self.do_click_mouse = int(self.options["human.click_mouse"])

        if "human.click_buttons" in self.options:
            self.do_click_buttons = int(self.options["human.click_buttons"])

        while self.do_run:
            if self.do_click_mouse:
                click_mouse()

            if self.do_move_mouse:
                move_mouse()

            if self.do_click_buttons:
                USER32.EnumWindows(EnumWindowsProc(foreach_window), 0)

            KERNEL32.Sleep(1000)
コード例 #3
0
    def run(self):
        nohuman = self.options.get("nohuman")
        if nohuman:
            return True

        while self.do_run:
            click_mouse()
            move_mouse()
            USER32.EnumWindows(EnumWindowsProc(foreach_window), 0)
            KERNEL32.Sleep(1000)
コード例 #4
0
ファイル: human.py プロジェクト: Cyber2020/nrl-cuckoo
    def run(self):
        try:
            seconds = 0
            randoff = random.randint(0, 10)

            # add some random data to the clipboard
            randchars = list(
                "   aaaabcddeeeeeefghhhiiillmnnnooooprrrsssttttuwy")
            cliplen = random.randint(10, 1000)
            clipval = []
            for i in range(cliplen):
                clipval.append(randchars[random.randint(0,
                                                        len(randchars) - 1)])
            clipstr = "".join(clipval)
            cliprawstr = create_string_buffer(clipstr)
            USER32.OpenClipboard(None)
            USER32.EmptyClipboard()

            buf = KERNEL32.GlobalAlloc(GMEM_MOVEABLE, sizeof(cliprawstr))
            lockbuf = KERNEL32.GlobalLock(buf)
            memmove(lockbuf, cliprawstr, sizeof(cliprawstr))
            KERNEL32.GlobalUnlock(buf)
            USER32.SetClipboardData(CF_TEXT, buf)
            USER32.CloseClipboard()

            nohuman = self.options.get("nohuman")
            if nohuman:
                return True

            officedoc = False
            if hasattr(self.config, "file_type"):
                file_type = self.config.file_type
                file_name = self.config.file_name
                if "Rich Text Format" in file_type or "Microsoft Word" in file_type or \
                    "Microsoft Office Word" in file_type or "MIME entity" in file_type or \
                    file_name.endswith((".doc", ".docx", ".rtf", ".mht", ".mso")):
                    officedoc = True
                elif "Microsoft Office Excel" in file_type or "Microsoft Excel" in file_type or \
                    file_name.endswith((".xls", ".xlsx", ".xlsm", ".xlsb")):
                    officedoc = True
                elif "Microsoft PowerPoint" in file_type or \
                    file_name.endswith((".ppt", ".pptx", ".pps", ".ppsx", ".pptm", ".potm", ".potx", ".ppsm")):
                    officedoc = True

            USER32.EnumWindows(EnumWindowsProc(getwindowlist), 0)

            while self.do_run:
                if officedoc and (seconds % 30) == 0 and not CLOSED_OFFICE:
                    USER32.EnumWindows(EnumWindowsProc(get_office_window), 0)

                # only move the mouse 50% of the time, as malware can choose to act on an "idle" system just as it can on an "active" system
                if random.randint(0, 3) > 1:
                    click_mouse()
                    move_mouse()

                if (seconds % (15 + randoff)) == 0:
                    curwind = USER32.GetForegroundWindow()
                    other_hwnds = INITIAL_HWNDS[:]
                    try:
                        other_hwnds.remove(USER32.GetForegroundWindow())
                    except:
                        pass
                    if len(other_hwnds):
                        USER32.SetForegroundWindow(other_hwnds[random.randint(
                            0,
                            len(other_hwnds) - 1)])

                USER32.EnumWindows(EnumWindowsProc(foreach_window), 0)
                KERNEL32.Sleep(1000)
                seconds += 1
        except Exception as e:
            error_exc = traceback.format_exc()
            log.exception(error_exc)
コード例 #5
0
ファイル: human.py プロジェクト: spagett/longcuckoo
 def run(self):
     while self.do_run:
         click_mouse()
         move_mouse()
         USER32.EnumWindows(EnumWindowsProc(foreach_window), 0)
         KERNEL32.Sleep(1000)
コード例 #6
0
ファイル: human.py プロジェクト: SNDBOXLTD/cuckoo_home
    def run(self):
        # human starts before the sample invocation, wait for 3s to start
        minimal_timeout = KERNEL32.GetTickCount() + 3000
        # set office close timeout after 2/3 of analysis (in milliseconds)
        office_close_sec = int(self.options.get("timeout") * (3. / 4) * 1000)
        office_close_timeout = KERNEL32.GetTickCount() + office_close_sec
        is_office_close = False
        is_full_screen = False
        pdf_clicks_ctr = 10

        # adaptive sleep timer
        sleep = 50 if self.is_ultrafast else 750

        while self.do_run:

            KERNEL32.Sleep(
                sleep)  # we wait for minimal timeout anyway so no loss here

            if KERNEL32.GetTickCount() < minimal_timeout:
                continue

            if not is_office_close and KERNEL32.GetTickCount(
            ) > office_close_timeout:
                USER32.EnumWindows(EnumWindowsProc(get_office_window), 0)
                is_office_close = True

            if self.do_click_mouse and self.do_move_mouse:
                # extract foregroud window name
                fg_window_name = ""
                hwnd = USER32.GetForegroundWindow()
                try:
                    fg_window_name = get_window_text(hwnd).lower()
                except:
                    log.exception("failed to extract window name")
                    pass

                # make the office window on front
                if fg_window_name in ["", "program manager"]:
                    x, y = self.coordinates.center()
                    move_mouse(x, y)
                    click_mouse(x, y)
                    continue
                else:
                    log.info("fg_window_name: %s", fg_window_name)

                if "word" in fg_window_name or "excel" in fg_window_name:
                    if not is_full_screen:
                        set_full_screen(hwnd)
                        is_full_screen = True
                    x, y = self.coordinates.next()
                    move_mouse(x, y)
                    double_click(x, y)

                elif "powerpoint" in fg_window_name:
                    if not is_full_screen:
                        set_full_screen(hwnd)
                        is_full_screen = True
                    x, y = self.coordinates.center()
                    move_mouse(x, y)
                    click_mouse(x, y)

                elif "acrobat reader" in fg_window_name:
                    if not is_full_screen:
                        set_full_screen(hwnd)
                        is_full_screen = True
                        # place cursor on top left
                        x, y = 120, 200
                        move_mouse(x, y)
                        click_mouse(x, y)

                    if pdf_clicks_ctr > 0:
                        # press tab
                        click_button(win32con.VK_TAB)
                        # press enter
                        click_button(win32con.VK_RETURN)
                        pdf_clicks_ctr = pdf_clicks_ctr - 1
                        # wait for result
                        KERNEL32.Sleep(1000)

                else:
                    # make random move
                    x, y = self.coordinates.random()
                    move_mouse(x, y)

            if self.do_click_buttons:
                USER32.EnumWindows(EnumWindowsProc(foreach_window), 0)